Hardening security images

ABSTRACT

Methods and systems are provided for electronic authentication. A modified electronic image is generated by altering at least a pixel of an electronic image. The electronic image is an image that has been previously viewed by a user during a setup process. In response to receiving an authentication request from the user, the modified electronic image is displayed to the user via an electronic display along with one or more other electronic images. A determination is made as to whether the user is able to recognize the modified electronic image. In response to determination that the user is able to recognize the modified electronic image, the authenticating request is granted.

CROSS REFERENCE TO RELATED APPLICATIONS

The present application is a continuation application of U.S. patentapplication Ser. No. 14/825,221, filed Aug. 13, 2015, which is acontinuation application of U.S. patent application Ser. No. 13/429,108,filed on Mar. 23, 2012, the disclosures of which are hereby incorporatedby reference in their entirety.

BACKGROUND Technical Field

The present disclosure generally relates to electronic authenticationand, more particularly, relates to the hardening of images that are usedfor electronic authentication such that the images are more resistant tomalware.

Related Art

Various computer systems require that a user answer one or morequestions in order authorize access of the user to a website or to otherfeatures or services offered by the computer system. By requiring thecorrect response to such questions, the computer system can determinethat a human being, rather than a machine, is most likely requesting theaccess. The computer system can also determine that the user is anauthorized user, e.g., the computer can determine an identity of theuser. It can be desirable to limit access to human beings becausecomputers are routinely used to mine databases for information that isnot intended to be disbursed in mass. It can be desirable to limitaccess to authorized users, such as when access to the website orservice is offered on a subscription basis and only users who have paidfor the subscription are authorized to have access.

One problem with such authentication questions is that their use hasbeen found to be objectionable to many users. Many users find thequestion and answer process too cumbersome and time consuming. Also,answering questions is subject to entry errors that can cause a user tohave to re-type a response. Images, rather than questions, can be usedfor authentication and can mitigate such problems.

However, both question and image base authentication systems areundesirably susceptible to malware. Malware installed upon a user'scomputer can too easily recognize and provide the correct answers orimages, thus undesirably allowing a machine to have unauthorized accessto the computer system.

SUMMARY

According to one or more embodiments, methods and systems are providedfor mitigating the undesirable susceptibility of images used in anauthentication process to malware. The images can be hardened or madeless susceptible to malware by modifying the images. For example, animage can be modified such that a checksum for the image is changed. Inthis manner, the modified image can be recognized or characterized muchmore readily by a human being than by a computer.

According to one or more embodiments, a system can comprise a memory forstoring a plurality of images and for storing account information for aplurality of users. The account information can include personal imageinformation for at least some of the users. A processor can receive acommunication including an indication of a desire of a user to beauthenticated. The processor can access an account of the user, modifythe plurality of images to form a modified plurality of images, providethe modified plurality of images to the user, receive trial personalimage information, e.g., image selections, from the user, compare thepersonal image information stored in the memory to the trial personalimage information received from the user, and authenticate the user ifthe personal image information stored in the memory is the same as thetrial personal image information.

Modifying the plurality of images can comprise making a change to atleast one of the plurality of images that will change a checksum of atleast one of the images. Modifying the plurality of images can comprisemaking a subtle change to at least one of the plurality of images ormaking an obvious change to at least one of the images. Modifying theplurality of images can comprise making a change to a plurality ofportions of the image(s). Modifying the plurality of images can comprisesubstituting a different image for at least one of the images. Thesubstituted different image(s) can be image(s) of the same type ofobject.

Thus, images can be used for authentication in a manner that issubstantially less susceptible to malware. Modifying the images canprevent the malware from recognizing the images during theauthentication process.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram showing a system for hardening security imagesused for authentication such that the images are resistant to malware,in accordance with one or more embodiments;

FIG. 2 is a flow chart showing a method for hardening security imagesused for authentication such that the images are resistant to malware,in accordance with one or more embodiments;

FIG. 3 is an example of an unmodified image that can be used forauthentication in accordance with one or more embodiments;

FIG. 4 is an example of a modified image, wherein a single pixel of theimage has been changed, in accordance with one or more embodiments;

FIG. 5 is an example of a modified image, wherein the image has beendivided into a plurality of portions and at least one pixel of the imagehas been changed in each portion, in accordance with one or moreembodiments;

FIG. 6 is an example of a modified image, wherein the image has beenmirrored, in accordance with one or more embodiments;

FIG. 7 is a is an example of a modified image, wherein the image hasbeen made smaller, in accordance with one or more embodiments;

FIG. 8 is a is an example of a modified image, wherein a border has beenplaced around the image, in accordance with one or more embodiments;

FIG. 9 is an example of a modified image, wherein a small change hasbeen made to the image, in accordance with one or more embodiments;

FIG. 10 is an example of a modified image, wherein a large change hasbeen made to the image, in accordance with one or more embodiments; and

FIG. 11 is an example of a modified image wherein a background of theimage has been changed, in accordance with one or more embodiments.

DETAILED DESCRIPTION

Images can be used instead of questions to facilitate authorization forsuch activities as entering a web sited, using a computer service,completing a purchase, retrieving a forgotten password, or performing afinancial transaction. Such authorization can help to assure that ahuman being, rather than a machine, is requesting the access or service.Many users prefer image identification or characterization to thecontemporary process of answering questions. This is particularly truefor touch screen devices that lack a keyboard.

The use of images, rather than questions, for authentication can be moreuser friendly and less subject to error, such as mistyping a response.

A user may be presented with a plurality of images by an authenticationserver. The user can then be prompted to identify or characterize theimages. The user can be asked to select images that match a description.For example, the user can be shown multiple images and then asked toselect a tree from among the images.

The user can be asked to select images that the user has previouslyselected or characterized. For example, during a setup process, the usercan be requested to identify which images the user likes or which imagesthe user dislikes. The user's response, e.g., the selected images, canbe stored by the authentication server. The user can later be presentedwith at least some of these images and then asked to identify which ofthe images the user likes and/or which of the images the user dislikesto facilitate authentication.

However, if malicious software, e.g., malware, is present on the user'ssystem, then the malware can capture the images and user's responseswhen the user performs an authentication process. The malware can alsocapture any associated image information such as filenames ordescriptions associated with the images. The malware can then use thecaptured images, responses, and associated information to mimic the userduring a subsequent authentication process. In this manner, the malwarecan gain illegitimate access to computers systems or services.

The malware can capture the entire images. Alternatively, the malwarecan create a checksum of each image (or a portion of each image) touniquely identify the image. There are a variety of ways to create achecksum, but a simple example is to sum of all the bytes in the image.The malware can record the checksums and responses locally.

The malware can recognize an image by forming a checksum of the imagewhen the image is presented in an authorization process and thencomparing that checksum to the checksums of images provided insubsequent authorization processes. Because the checksums are normallylarge numbers, there is a very high probability that the checksums ofdifferent images will be different. The checksums of identical imageswill always be the same. Thus, when the checksums of two images are thesame, it can generally be assumed that the images are the same.

Thus, the malware can pretend to be the legitimate user by recognizingand selecting the same images that were previously selected by thelegitimate user. The malware can recognize images by matching the imagefilename, image description, complete image file contents (the imageitself), or the checksum for the image against a previously recordedimage selection.

The malware can report the checksums or other image identifyinginformation and the user's responses to a remote computer. In thismanner, the malware can recognize the images used in the authorizationprocess and can gain illegitimate access to computers systems orservices via the user's computer or via another, e.g., the remotelylocated, computer.

According to one or more embodiments, methods and systems are providedfor mitigating the undesirable susceptibility of images used in anauthentication process to malware. The images can be hardened or madeless susceptible to malware by modifying the images. For example, animage can be modified such that a checksum for the image is changed. Theimages can be modified prior to each use. Modified images can berecognized or characterized much more readily by a human being than by acomputer. Thus, the use of malware to gain illegitimate access tocomputer systems and services can be substantially mitigated.

It is worthwhile to note that images can be substantially modified sothat it is very difficult, if not impossible given today's technology,for a computer to recognize the images. However, even with suchextensive modification, a human can still readily recognize the images.

FIG. 1 is a block diagram showing a system for hardening security imagesused for authentication such that the images are resistant to malware,in accordance with one or more embodiments. The system can comprise auser device 101 and an authentication server 102.

The user device 101 can be a merchant terminal, an automatic tellermachine (ATM), a computer, a game console, a cellular telephone, or thelike. The user device 101 can comprise a display 106, a processor 109,and a memory 110. The images used for authentication can be shown uponthe display 106, for example.

The authentication server 102 can be a payment server, an onlinemerchant website server, or any other type of computer, server, ornetwork thereof. The authentication server 102 can comprise a processor121 and a memory 122.

The processor 121 and the memory 122 of the authentication server 102can cooperate to inhibit malware from recognizing images and thenattempting to mimic a user's responses to the images to gainillegitimate access to computer systems and services that are intendedfor human access. In this manner, such illegitimate access can besubstantially thwarted.

The memory 122 can store a plurality of images for use in authenticatingthe user, as discussed herein. The memory 122 can store a large pool ofimages for use with all users. The memory 122 can store a largerplurality of images than is typically used for a single authenticationof a user such that the same images are not provided to a given user forevery authentication of that user. The memory 122 can store accountinformation for a plurality of users. The account information caninclude personal image information for at least some of the users. Forexample, the personal image information can be indicative of the user'sidentification of the images and/or the user's characterization of theimages. Thus, the memory 122 can store the user's previous responses toquestions regarding the images. This information can be used insubsequent authentication processes.

The user's characterization of an image can include a name that the userassociates with the image. The user's characterization of an image caninclude a feeling or emotion associated by the user with the image. Forexample, the characterization can regard the users like or dislike ofeach of the images.

FIG. 2 is a flow chart showing a method for hardening security imagesused for authentication such that the images are resistant to malware,in accordance with one or more embodiments. The user can initiateauthentication, as shown in step 201. The user can initiateauthentication by beginning a log on or authentication process with theuser device 101. For example, the user can begin to log on to a merchantweb site with the user device 101. As a result of the user initiatingauthentication, the processor 121 of the authentication server 102 canreceive a communication including an indication of a desire of the userto be authenticated. The processor 121 can access an account of the userto determine which images stored in the memory 122 are to be sent to theuser during the authentication process. Generally, images previouslyprovided to the user and identified or characterized by the user will besent to the user during the authentication process.

The authentication server 102 can retrieve user account images for theuser from the user's account and can modify the user account images foruse in the authentication process, as shown in step 202. The images canbe modified using the processor 121 to form a modified plurality ofimages. Modifying an image can comprise making a change to the imagesthat will change a checksum of the images. Modifying an image cancomprise making either a subtle change to the image or making an obviouschange to the image. A subtle change can be a change that issubstantially undetectable to many people. That is, subtle change can besome slight change that a person observing the image is not likely tonotice. For example, a subtle change can be a change to only one pixelor a very small change to many pixels.

An obvious change can be a change that is readily noticed by manypeople. The obvious change can be a change that does not substantiallyvary the fundamental character of the image. For example, the obviouschange can be a change from a maple tree to an oak tree. Such a changecan readily be noticed by many people. However, the fundamentalcharacter of the image remains the same. Both the maple tree and the oaktree are trees.

A change can be made to a plurality of portions of the image. Forexample, the image can be divided into a plurality of sections and achange can be made to each section of the image, as discuss furtherbelow. Modifying an image can comprise changing at least one pixel ofthe image. For example, the color or other information of the pixel canbe changed. Any of the information that defines the pixel can bechanged. Any number of pixels can be changed. Modifying an image cancomprise changing a color of a portion of the image or of the entireimage. A color pallet of the image can be changed. For example, colorpalette depth can be changed from a large number of colors, e.g., 64,000colors to a smaller number of colors, e.g., 8 colors. The color palletof the image can be inverted. A color image can be changed to a grayscale image. A gray scale image can be changed to a color image.

The image can be changed to an outline, shadow, profile, or silhouette.For example, a photograph of a tree can be changed into a silhouette ofthe tree. The image can be modified by moving the image. For example,the image can be translated the image or rotated. To translate theimage, the image can be shifted horizontally, vertically, or acombination of horizontally and vertically by a few pixels. The imagecan be rotated about its center, one of its corners, or any other pointeither in the image or outside of the image.

The image can be modified by pixelating the image. Any number of pixelscan be combined in the pixelation process. For example, the pixelationscan contain two, three, four, five, six, or more pixels. The pixilationcan be either subtle or obvious. The image can be modified by changing aresolution of the image. The change in resolution can be to a higherresolution or to a lower resolution. The change in resolution can beeither subtle or obvious. The image can be modified by cropping theimage. The image can be cropped in any manner. The image can be croppedonly horizontally or only vertically. The image can be cropped bothhorizontally and vertically. The image can be cropped by a single lineof pixels. The cropping can be either subtle or obvious.

The image can be modified by changing an object, such as a backgroundobject, of the image. For example, a background color of the image canbe changed. An item in the background of the image can be removed,added, or changed. The image can be modified by mirroring the image. Forexample, the image can be flipped about a vertical centerline. The imagecan be flipped about any other line, whether horizontal, vertical, orsloped. The image can be modified by adding a border to the image. Theborder can be plane or fancy. The border can contain a pattern. Theimage can be modified by removing an existing border from the image. Theimage can be modified by changing an existing border of the image.

The image can be modified by adding an object to the image. For example,a tree can be added to an image of trees. The image can be modified byremoving an object from the image. For example, one tree can be removedfrom an image showing a plurality of trees. The image can be modified bychanging an object in the image. For example one type of tree can bechange to another type of tree.

The image can be modified by warping the image. For example, the imagecan be stretched or bent, either vertically, horizontally, or both. Onlya portion of the image can be warped. The warping can be either subtleor obvious. The image can be modified by changing a size of the image.The image can be changed to be either larger or smaller. The image canbe modified by changing an aspect ratio of the image.

The size of an item in the image can be changed. For example, a tree inthe image can be made smaller. Objects within the image can change withrespect to a z-axis (an axis that is perpendicular to the plane of theimage). For example, a flock of birds could fly behind a tree instead ofin front of the tree. The image can be rotated or tilted slightly. Forexample, the plane of the image could be tilted to provide the effect ofviewing a rhombus shaped image instead of a square image.

A combination of such changes can be made to an image to better thwartmalware's ability to recognize the images. Indeed, the entire image canbe changed to another, generally similar image or type of image. Thus,an image of one tree can be changed to an image of a different tree. Thedifferent tree can be in a different setting, i.e., can have analtogether different background.

All of the images used for the authentication of a particular user canbe modified. Alternatively, only some of the images used for theauthentication of a particular user can be modified. Generally, at leastone of the images is modified.

Generally, any change or combination of changes that results in adifferent checksum can be performed by the processor 121. The processor121 can verify that the checksum of the modified image is different withrespect to the checksum of the unmodified image. If the checksum of themodified image is not different with respect to the checksum of theunmodified image, then the image can be re-modified. The process ofmodifying the image, verifying that the checksum is different, andre-modifying the image can be repeated as necessary to obtain a modifiedimage with a different checksum.

The order of the images can be randomized each time the images arepresented to the user. Thus, the user can see the images in a differenttime order and/or at a different position on the display 106 for eachauthentication process. Such order randomization can help preventmalware from simply selecting images based on the image order orposition.

The filenames for the images can be randomly created each time theimages are presented to the user. This will prevent the malware fromsimply capturing the image name to identify the images. Imagedescriptions can be omitted to prevent their use by malware.

The authentication server 102 can communicate the modified user accountimages to the user device 101, as shown in step 203. Thus, the user canbe presented with the modified images, such as by viewing the modifiedimages on display 106. Any number of modified images can be communicatedto the user device 101. Not all of the images have to be modified. Anynumber of unmodified images can be communicated to the user device 101.

The user can select images, identify images, or characterize images thatare shown on the display 106 of the user device 101. The user can selectimages stored specifically for the user's account and then modified,e.g., the modified user account images, from a larger set of images thatare presented to the user as shown in step 204. Images of the larger setcan be stored locally, e.g., on the user device 101, or can becommunicated from the authentication server 102 along with the modifieduser account images. For example, the user can select only images thatwere previous presented to the user, such as during a setup process. Asa further example, the user can select only images that the user haspreviously selected, such as during the setup process. The selectedimages can define trial personal image information.

As a further example, the user can indicate whether the user likes ordislikes each of the images and this information can define trialpersonal image information. The user image selections or trial personalimage information can be communicated from the user device 101 to theauthentication server 102, as shown in step 205.

The authentication server 102 can compare stored user account images orpersonal image information to the user image selections or trialpersonal image information, as shown in step 206. The stored personalimage information can be stored in and retrieved from the memory 122 ofthe authentication server 102. The stored personal image information canbe information that was obtained from the user at an earlier time andstored for later use. For example, the user can have been presented withimages and asked to indicate which images the user likes and dislikesduring an earlier setup process. Alternatively, the user can have beenpresented with images and asked to indicate which images the user likesand dislikes during an initial authentication process. Questions, ratherthan images, can be used for authentication during such an initialauthentication process. Any desired number of images can be presentedand characterized during this setup process. A different subset of theseimages can be used later for each authentication process.

The user can be authorized to proceed if the stored user account imagesor personal image information is the same as the user image selectionstrial personal image information, as shown in step 207. The storedpersonal image information will be the same as the trial personal imageinformation if the user has indicated that the same images are liked anddisliked as in the earlier setup or authentication process. If thestored personal image information is not the same as the trial personalimage information, then different images or the same images can be sentfrom the authentication server 102 to the user device 101 and theprocess can be repeated.

The use of a user's likes and/or dislikes of images herein is by way ofexample only and not by way of limitation. Rather than the user's likesand dislikes, the images can be selected based upon any criteria. Forexample, only images previous presently to the user can be selected oronly images previously selected by the user can be again selected inorder to obtain authorization.

FIG. 3 is an example of an unmodified image that can be used forauthentication in accordance with one or more embodiments. This exampleof an unmodified image includes a tree 301 and three birds 302. Theunmodified image can be used in the setup process or in an initialauthentication process. The image can be modified for subsequent use ofthe image.

FIGS. 4-11 show how an image can be modified by making various differentchanges to the image. These are examples of changes that can be made toan image. Many other, different, changes and/or combinations of changescan likewise be used.

FIG. 4 is an example of a modified image, wherein a single pixel 303 ofthe image has been changed, in accordance with one or more embodiments.The single pixel 303 can be any pixel of the image. The single pixel 303can be changed in any manner that results in a different checksum forthe image. Typically, any change to a pixel will result in a differentchecksum for the image. Any bit, byte, or word of an image file can bechanged to provide the modified image. When changes to an image arediscussed here, such changes can be made to the image file.

FIG. 5 is an example of a modified image, wherein the image has beendivided into a plurality of portions 501 and at least one pixel 501 ofthe image has been changed in each portion 501, in accordance with oneor more embodiments. The image can be divided into any number ofportions 501. Each portion 501 can be of any size. The image can containportions 501 of different sizes. Any number of pixels can be changed ineach portion 501. The portions 501 can be square, rectangular, or haveany other shape. The portions 501 can have regular shapes or irregularshapes. For example, the image can be divided into a plurality ofportions 501 similar to the manner in which a jigsaw puzzle is cut, e.g.using irregular lines.

Malware can identify an image by identifying only a portion of theimage. By modifying plural portions of the image (such as portions 501of the image), the ability of malware to identify an image byidentifying only a portion of the image can be substantially mitigated.

FIG. 6 is an example of a modified image, wherein the image has beenmirrored, in accordance with one or more embodiments. The image has beenmirrored by flipping the image about its vertical centerline.

FIG. 7 is an example of a modified image, wherein the image has beenmade smaller, in accordance with one or more embodiments. The image canbe made only slightly smaller, such that the difference is subtle. Theimage can be made substantially smaller, such that the difference inobvious.

FIG. 8 is an example of a modified image, wherein a border 801 has beenplaced around the image, in accordance with one or more embodiments. Theborder can have any desired width, shaped, or ornamentation.

FIG. 9 is an example of a modified image, wherein a small change hasbeen made to the image, in accordance with one or more embodiments. Oneof the birds 302 has been omitted. Such a small change can be subtle.

FIG. 10 is an example of a modified image, wherein a large change hasbeen made to the image, in accordance with one or more embodiments. Aplurality of trees 1001-1003 have been substituted for the single tree301 of FIG. 1 and a larger plurality of birds 1011-1015 have beensubstituted for the three birds of FIG. 1. The large change can beobvious.

FIG. 11 is an example of a modified image wherein a background of theimage has been changed, in accordance with one or more embodiments. Ahorizon 1104 and a plurality of clouds 1101-1103 have been added to thebackground. The added items can be either subtle or obvious.

The images can be modified every time the images are provided to theusers. All of the images can be modified every time the images areprovided to the user. Some of the images, but not all of the images, canbe modified every time the images are provided to the user. A randomnumber of the images can be modified every time that the images areprovided to the user. The images to be modified can be selectedrandomly.

As used herein, the term “authentication” can be defined to includedetermining an identification of a person. Further, as used herein, theterm “authentication” can be defined to include determining a humanbeing is being communicated with. In either instance, the communicationcan be for such purposes as making a purchase (either online or in abrick and mortar store), accessing an account (such as a bank, paymentservice, or credit card account), retrieving a forgotten password, oraccessing a web site.

As used herein, the term “subtle” can be defined to indicate changes toan image that cannot be visually detected by a human being.

As used herein, the term “obvious” can be defined to indicate changes toan image that can be visually detected by a human being.

As used herein, the term “checksum” can include a parity, a hash, a hashsum, a cyclic redundancy check (CRC), a fingerprint, or any other item,e.g., formula or algorithm, suitable for identifying, although notnecessarily uniquely, an image.

As used herein, the term “recognize” can be used to indicate that a userappreciates that one image has something in common with another image.For example, an unmodified image of a tree and a modified image of atree (which can be either the same tree or a different tree) can both berecognized as being trees.

As used herein, the term “characterize” can be used to indicate that auser appreciates some attribute or characteristic of an image. Theattribute or characteristic can be either objective or subjective. Forexample, the user can indicate a color of an object of the image as asubjective characteristic of the image. For example, the user canindicate a like or a dislike of the image as a subjective characteristicof the image. The terms “recognize” and “characterize” can be usedsynonymously herein.

In implementation of the various embodiments, embodiments of theinvention may comprise a personal computing device, such as a personalcomputer, laptop, PDA, cellular phone or other personal computing orcommunication devices. The payment provider system may comprise anetwork computing device, such as a server or a plurality of servers,computers, or processors, combined to define a computer system ornetwork to provide the payment services provided by a payment providersystem.

In this regard, a computer system may include a bus or othercommunication mechanism for communicating information, whichinterconnects subsystems and components, such as a processing component(e.g., processor, micro-controller, digital signal processor (DSP),etc.), a system memory component (e.g., RAM), a static storage component(e.g., ROM), a disk drive component (e.g., magnetic or optical), anetwork interface component (e.g., modem or Ethernet card), a displaycomponent (e.g., CRT or LCD), an input component (e.g., keyboard orkeypad), and/or cursor control component (e.g., mouse or trackball). Inone embodiment, a disk drive component may comprise a database havingone or more disk drive components.

The computer system may perform specific operations by processor andexecuting one or more sequences of one or more instructions contained ina system memory component. Such instructions may be read into the systemmemory component from another computer readable medium, such as staticstorage component or disk drive component. In other embodiments,hard-wired circuitry may be used in place of or in combination withsoftware instructions to implement the invention.

Logic may be encoded in a computer readable and executable medium, whichmay refer to any medium that participates in providing instructions tothe processor for execution. Such a medium may take many forms,including but not limited to, non-volatile media, volatile media, andtransmission media. In one embodiment, the computer readable medium isnon-transitory. In various implementations, non-volatile media includesoptical or magnetic disks, such as disk drive component, volatile mediaincludes dynamic memory, such as system memory component, andtransmission media includes coaxial cables, copper wire, and fiberoptics, including wires that comprise bus. In one example, transmissionmedia may take the form of acoustic or light waves, such as thosegenerated during radio wave and infrared data communications.

Some common forms of computer readable and executable media include, forexample, floppy disk, flexible disk, hard disk, magnetic tape, any othermagnetic medium, CD-ROM, any other optical medium, punch cards, papertape, any other physical medium with patterns of holes, RAM, ROM,E2PROM, FLASH-EPROM, any other memory chip or cartridge, carrier wave,or any other medium from which a computer is adapted to read.

In various embodiments, execution of instruction sequences forpracticing the invention may be performed by a computer system. Invarious other embodiments, a plurality of computer systems coupled by acommunication link (e.g., LAN, WLAN, PTSN, or various other wired orwireless networks) may perform instruction sequences to practice theinvention in coordination with one another.

Modules described herein can be embodied in one or more computerreadable media or be in communication with one or more processors toexecute or process the steps described herein.

A computer system may transmit and receive messages, data, informationand instructions, including one or more programs (i.e., applicationcode) through a communication link and a communication interface.Received program code may be executed by a processor as received and/orstored in a disk drive component or some other non-volatile storagecomponent for execution.

Where applicable, various embodiments provided by the present disclosuremay be implemented using hardware, software, or combinations of hardwareand software. Also, where applicable, the various hardware componentsand/or software components set forth herein may be combined intocomposite components comprising software, hardware, and/or both withoutdeparting from the spirit of the present disclosure. Where applicable,the various hardware components and/or software components set forthherein may be separated into sub-components comprising software,hardware, or both without departing from the scope of the presentdisclosure. In addition, where applicable, it is contemplated thatsoftware components may be implemented as hardware components andvice-versa—for example, a virtual Secure Element (vSE) implementation ora logical hardware implementation.

Software, in accordance with the present disclosure, such as programcode and/or data, may be stored on one or more computer readable andexecutable mediums. It is also contemplated that software identifiedherein may be implemented using one or more general purpose or specificpurpose computers and/or computer systems, networked and/or otherwise.Where applicable, the ordering of various steps described herein may bechanged, combined into composite steps, and/or separated into sub-stepsto provide features described herein.

The foregoing disclosure is not intended to limit the present inventionto the precise forms or particular fields of use disclosed. It iscontemplated that various alternate embodiments and/or modifications tothe present invention, whether explicitly described or implied herein,are possible in light of the disclosure. Having thus described variousexample embodiments of the disclosure, persons of ordinary skill in theart will recognize that changes may be made in form and detail withoutdeparting from the scope of the invention. Thus, the invention islimited only by the claims.

1-20. (canceled)
 21. A system for performing electronic authentication,the system comprising: a non-transitory memory; and one or more hardwareprocessors coupled to the non-transitory memory and configured to readinstructions from the non-transitory memory to cause the system toperform operations comprising: receiving an authentication request froma user; retrieving an image associated with an account of the user;electronically modifying the image; communicating the electronicallymodified image to the user; determining a user response to theelectronically modified image; and authenticating the user based on theuser response.
 22. The system of claim 21, wherein the operationsfurther comprise: displaying, before the authentication request isreceived, the image to the user; and receiving, before theauthentication request is received, a user response to the displayedimage; wherein the determining comprises comparing the user response tothe displayed image with the user response to the electronicallymodified image.
 23. The system of claim 21, wherein the electronicallymodified image is different from a previous electronically modifiedimage resulting from a previous authentication request from the user.24. The system of claim 21, wherein: the determining the user responsecomprises: determining whether the user recognizes the electronicallymodified image as being associated with the image that is retrieved; andthe authenticating the user comprises granting the authenticationrequest in response to a determination that the user recognizes theelectronically modified image as being associated with the image that isretrieved.
 25. The system of claim 24, wherein the determining whetherthe user recognizes the electronically modified image comprisesdetermining whether the user likes or dislikes the image.
 26. The systemof claim 21, wherein the electronically modifying the image is performedsuch that a checksum of the image is different from a checksum of theelectronically modified image.
 27. The system of claim 21, wherein theelectronically modifying the image comprises: dividing the image into aplurality of sections; and altering the image in each of the sections.28. The system of claim 21, wherein the electronically modifying theimage comprises changing a color pallet of the image.
 29. The system ofclaim 21, wherein the electronically modifying the image comprisesgenerating an outline, a shadow, a profile, or a silhouette of theimage.
 30. The system of claim 21, wherein the electronically modifyingthe image comprises moving, rotating, or cropping at least a portion ofthe image.
 31. The system of claim 21, wherein the electronicallymodifying the image comprises changing a resolution of the image. 32.The system of claim 21, wherein the electronically modifying the imagecomprises pixelating the image.
 33. The system of claim 21, wherein theelectronically modifying the image comprises adding an objecting to theimage or removing an object from the image.
 34. The system of claim 21,wherein the electronically modifying the image comprises warping atleast a portion of the image or changing a size of an item in the image.35. The system of claim 21, wherein the communicating the electronicallymodified image comprises generating a random file name for theelectronically modified image.
 36. A method, comprising: receiving, froma computing device, an authentication request from a user; determiningan account of the user based on the authentication request; retrievingan image associated with the account of the user; electronicallymodifying the image in a manner such that a checksum of the image beforethe electronically modifying is different from a checksum of theelectronically modified image; communicating the electronically modifiedimage to the computing device; determining, through a user interactionon the computing device, whether the user recognizes the electronicallymodified image as being associated with the image that is retrieved; andgranting the authentication request in response to a determination thatthe user recognizes the electronically modified image as beingassociated with the image that is retrieved.
 37. The method of claim 36,further comprising: displaying, before the authentication request isreceived, the image to the user; and receiving, before theauthentication request is received, a user response to the displayedimage; wherein the determining comprises comparing the user response tothe displayed image with the user response to the electronicallymodified image.
 38. The method of claim 36, wherein: the electronicallymodified image is different than a previously modified image resultingfrom a previous authentication request is received from the user; thedetermining whether the user recognizes the electronically modifiedimage comprises determining whether the user likes or dislikes theimage; and the communicating the electronically modified image comprisesgenerating a random file name for the electronically modified image. 39.The method of claim 36, wherein the electronically modifying the imagecomprises at least one of: dividing the image into a plurality ofsections and altering the image in each of the sections; changing acolor pallet of the image; generating an outline, a shadow, profile, ora silhouette of the image; moving, rotating, or cropping at least aportion of the image; changing a resolution of the image; pixelating theimage; adding an objecting to the image or removing an object from theimage; or warping at least a portion of the image or changing a size ofan item in the image.
 40. A non-transitory machine-readable mediumhaving stored thereon machine-readable instructions executable to causea machine to perform operations comprising: receiving an authenticationrequest from a user after a setup process has been performed thatassociates a first image and a first user response to the first imagewith an account of the user; altering the first image by at least oneof: dividing the image into a plurality of sections and altering theimage in each of the sections; changing a color pallet of the image;generating an outline, shadow, profile, or silhouette of the image;moving, rotating, or cropping at least a portion of the image; changinga resolution of the image; pixelating the image; adding an objecting tothe image or removing an object from the image; or warping at least aportion of the image or changing a size of an item in the image;communicating the altered image to the user; receiving a second userresponse to the altered image; comparing the second user response withthe first user response; and granting the authentication request basedon the comparing.